Inspection-ready. Every day.
Cybersecure organises all of your organisation’s NIS 2 compliance — governance, risk, suppliers, incidents and reporting — and keeps the evidence ready for the CNCS.
8
connected modules
9
Art. 27 measure areas
18
sectors covered
24 h
for the initial CNCS notification
Why
From spreadsheet to evidence.
Without Cybersecure
With Cybersecure
Without Cybersecure: Evidence scattered across emails, folders and spreadsheets.
With Cybersecure: All evidence in one place, with an immutable audit trail.
Without Cybersecure: Critical suppliers managed by hand, with no alerts.
With Cybersecure: Suppliers classified, with due diligence and critical ICT functions identified.
Without Cybersecure: Notification deadlines tracked from memory.
With Cybersecure: A CNCS notification timeline for every incident.
Without Cybersecure: The annual report rushed together, every year.
With Cybersecure: Annual report and supervision dossier generated automatically.
The modules
Eight modules that work together.
Each module addresses a specific obligation in Decree-Law 125/2025. Together they cover the full compliance cycle.
- 01Core
Executive dashboard
Real-time KPIs, risk matrix, maturity index and a 360° view of compliance.
- 02Risk
Risk engine
Scenarios, likelihood × impact, a 5×5 matrix, treatment plans and residual risk.
- 03Inventory
Asset management
A complete ICT inventory, with CIA+A classification and automatic criticality.
- 04Art. 27
Cybersecurity measures
All 9 measure areas, with 0–5 maturity and the legal deadlines.
- 05Art. 28
Supply chain
Due diligence, supplier classification and critical ICT functions.
- 06Arts. 40–44
Incident management
Classification, a significance engine, CNCS notifications and crisis management.
- 07Art. 30
Reports and dossier
Annual report, supervision dossier and inspection simulation, generated automatically.
- 08RBAC
Governance and access
Legal classification, management bodies, NIS 2 roles and role-based access.
Incidents
An incident at 3 a.m. The clock starts now.
The significance engine assesses whether the incident must be notified — and Cybersecure tracks every deadline until it is closed.
0 h
Awareness
The incident is logged and classified.
24 h
Initial notification
First report to the CNCS (Art. 42).
72 h
Update
An updated assessment of the incident.
+24 h
End of impact
Within 24 h of the impact ending (Art. 43).
30 days
Final report
Within 30 working days of the end of impact.
Portuguese law
Built for Portuguese law.
- DL 125/2025
- NIS 2 framework
- Art. 27
- 9 measure areas
- Arts. 40–44
- CNCS notification
- Art. 30
- Annual report
- GDPR
- Configurable retention
- Audit
- Immutable log
Updated by NEXUS TECHTRUST’s legal team whenever the law changes.
For decision-makers
Built for managers.
No technical knowledge needed. Every requirement explained, step by step.
A plan with deadlines. The obligations and deadlines for your classification.
Time to adapt. Shows the adaptation under way that Art. 65 requires to waive fines in year one.
Secure from day one.
- Sensitive data encrypted
- Multi-factor authentication
- An isolated environment per organisation
- A complete, immutable audit trail
Frequently asked questions
Is my organisation covered by NIS 2?
If you operate in one of the 18 sectors in Annexes I and II of Decree-Law 125/2025 and are a medium or large company, it is very likely — and some smaller companies are covered too. The free checker answers in under 2 minutes.
Can I produce reports for inspections and audits?
Yes. It generates the annual report (Art. 30), the evidence dossier for the CNCS and an inspection simulation, all exportable to PDF.
How much does it cost?
Cybersecure is in early access. The first customers get every feature on preferential terms, with a proposal tailored to their organisation.
See Cybersecure with your organisation’s data.
Early access is limited.